Attackers infect 953 online stores in campaign targeting mostly Magento

First reported by SecurityWeek at · Updated · 4 sources

The campaign has been active since July 2025, according to Sansec researchers. Attackers place small snippets on store pages and hide malicious JavaScript loaders in Magento CMS blocks. SecurityWeek reports that the injected code can deliver a payload or remain inactive to avoid detection by security scanners.

  • Security Affairs reports that the campaign uses five domains and bot filtering.

Covered by 4 publishers within 19 hours of the first report.

Reporting4

SecurityWeek 953 Online Stores Infected in Long-Lasting Malware Campaign · Ionut Arghire
The Hacker News Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento · info@thehackernews.com (The Hacker News)
Security Affairs Magento Campaign Infects 953 Online Stores Across Five Domains · Pierluigi Paganini
Cyber Security News Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners · Tushar Subhra Dutta